1. Field of the Invention
The present invention relates to an electronic control apparatus used, for example, for controlling operation of a vehicle-mounted actuator such as a throttle valve actuator, more particularly to an electronic control apparatus having a self-monitoring function and also a function of monitoring this self-monitoring function by use of a monitor module, the self-monitoring function being configured to self-monitor a drive command sent from a microcomputer of the electronic control apparatus to a drive circuit of a vehicle-mounted actuator.
2. Description of Related Art
Such an electronic control apparatus is described, for example, in Published Japanese Translation No. 11-505587 of a PCT Application. FIG. 22 is a block diagram showing a typical structure of an electronic control apparatus of the type described above.
As shown in this figure, the electronic control apparatus, which is used, for example, for controlling an actuator (motor) for opening and closing a throttle valve, is constituted mainly by a microcomputer 10, a monitor module 20, and a drive circuit 30.
The microcomputer 10, which is for performing various computations necessary for controlling the actuator (electric motor), has an input section 11, a control section 12, a self-monitoring section 13, a program executing section 14, and a communication section 15 as shown in FIG. 22. To control the actuator, the control section 12 takes in an external signal representing a depressed amount of a gas pedal etc. through the input section 11 which serves to mediate information exchange between the control section 12 and external sensors or devices (not shown). The control section 12 performs computation on the external signal to produce a controlled variable (control amount) by which the actuator controls the throttle valve. The computed controlled variable is outputted to the drive circuit 30 as a drive command.
The external signal is also taken in by the self-monitoring section 13 which serves to monitor the operation of the control section 12. The self-monitoring section 13 performs computation similar to that performed by the control section 12. The result of the computation in the self-monitoring section 13 is compared with the drive command outputted from the control section 12. The result of the comparison is supplied to the drive circuit 30 as a signal (information) indicative of validity of the drive command.
The program executing section 14 is for executing in cooperation with the monitor module 20 a monitoring program in order to monitor abnormality in the self-monitoring section 13. The program executing section 14 starts executing the monitoring program upon receiving a test signal from the monitor module 20 through the communication section 15 included in the microcomputer 10. More specifically, the program executing section 14 outputs a certain data set designated by the monitoring program to the self-monitoring section 13. After that, the program executing section 14 takes in the result of the computation on the data set performed by the self-monitoring section 13, and sends it to the monitor module 20 through the communication section 15. The communication section 15 of the microcomputer 10 is a section for mediating information exchange with a communication section 22 of the monitor module 20 by serial communication.
The monitor module 20 constituted by the communication section 22 and an abnormality determining circuit 21 is formed as a custom IC or a backup computer configured to monitor abnormality in the self-monitoring section 13 on the basis of information sent from the program executing section 14 through the communication section 15 and the communication section 22.
To monitor the self-monitoring section 13, the abnormality determining circuit 21 takes in the result of the computation on the certain data set sent from the program executing section 14 of the microcomputer 10. And the abnormality determining circuit 21 compares this computation result with an expected value stored therein. The result of the comparison is supplied to the drive circuit 30 as a monitoring result on the self-monitoring section 13. The abnormality determining circuit 21 also serves to output the test signal to the program executing section 14 of the microcomputer 10 at regular time intervals.
The drive circuit 30 is a section for driving the actuator to open and close the throttle valve in accordance with the drive command received from the control section 12 under normal condition, although it receives other signals from the self-monitoring section 13 and the abnormality determining circuit 21. However, when the signal received from the self-monitoring section 13 indicates inconsistency between the drive command outputted from the control section 12 and the result of the computation by the self-monitoring section 13, or when the signal received from the abnormality determining circuit 21 indicates inconsistency between the result of the computation on the certain data set and the expected value, the reliability of the drive command outputted from the control section 12 to the drive circuit 30 is low. Accordingly, in such cases, the drive circuit 30 performs a fail-safe process negating the drive command received from the control section 12 to ensure vehicle safety.
With the electronic control apparatus of the type having the self-monitoring function for monitoring the drive command and also the function of further monitoring the self-monitoring function as described above, the reliability of the throttle valve control can be greatly improved. However, even in the electronic control apparatus of such type, if the monitor module itself develops a problem, the reliability of the throttle valve control cannot be ensured.